I. Field of the Invention
This invention relates generally to implantable cardiac rhythm management devices incorporating a microprocessor-based controller, and more particularly to a microprocessor-based controller incorporating a Watchdog timer whose time-out period is programmable to facilitate deterministic modeling of worse case performance during design testing of the device.
II. Discussion of the Prior Art
State-of-the-art cardiac rhythm management devices, including bradycardia pacemakers, anti-tachycardia pacemakers and defibrillators typically incorporate microprocessor-based controllers capable of accepting input information from physiologic sensors and for providing therapy through timed application of cardiac stimulating pulses to the heart when sensed conditions dictate. The software/firmware executed by the microprocessor typically involve a large plurality of multi-tasking operations being executed in a real-time mode. As such, various events are carried out asynchronously and, frequently, multiple events happen concurrently. Thus, the time required to execute a certain function can vary significantly. Variations in the electronic circuitry itself can also result in variations in the length of time required to execute certain tasks. Then, too, variations in the system clock circuitry that drives the microprocessor can also cause variation in the length of time it takes to execute a given function.
Efforts of development engineers working on CRMD designs to arrive at an accurate deterministic model of the device""s performance are necessarily adversely impacted by such variations. For this reason, the microprocessor embodies a so-called Watchdog timer which is a circuit that is used to insure that the device meets time requirements and to cause a system reset in the event of a system failure occurring because an instruction string is not executed within specified time constraints. Watchdog timers heretofore used in CRMDs of which we are aware have a fixed time-out period of, for example, 32 ms, set by hard-wired circuit components. The software/firmware being executed provides for the delivery of an interrupt signal to the Watchdog timer, which is used to reset the Watchdog timer. Such interrupt signals are designed to be delivered at intervals shorter than the fixed time-out period established for the Watchdog timer. If due to asynchronous events or variations in hardware, the time to execute a software or firmware string becomes excessive and no interrupt is generated to reset the Watchdog timer before expiration of its fixed time-out period, the Watchdog circuit will reset the microprocessor to escape the error condition and to restart the device with its default values.
System resets by the Watchdog timer are to be avoided once the device has been implanted. For example, if a patient should be experiencing an episode of ventricular fibrillation, it is important that the CRMD deliver a cardioverting shock on a timely basis and that the device not suffer a Watchdog reset at this critical moment and thereafter undergo reinitiation before the shock can be delivered. Reinitiation can take a minute or more and during this time therapy is being withheld. It is, therefore, very important that, following implant, a combination of events involving either hardware, software or firmware come into play to extend the time for execution of a software or firmware defined function beyond the time-out period of the Watchdog timer employed.
During development of microprocessor-based CRMDs, when development engineers are creating a deterministic model of how long a given function will take to execute, it would be beneficial to have a Watchdog timer whose time-out period can be programmed in, rather than being fixed in length. Then, the period of the Watchdog timer could be set to a shortened value and if it is found that a given function executes in the shortened period, it is all but guaranteed that it will execute in a longer period set into the Watchdog timer at the time of final testing and prior to its being furnished to the implanting surgeon.
It is accordingly an object of the present invention to provide a CRMD having a programmable Watchdog timer for detecting fault conditions in hardware, software and/or firmware where the time-out period of the Watchdog timer can be programmed to any of a plurality of predetermined time intervals.
In accordance with the present invention, the foregoing objects are attained by providing a CRMD of a type having a sensing circuit for detecting cardiac depolarization events, a pulse generator for delivering cardiac stimulating pulses to the heart and a microprocessor-based controller that is coupled to receive electrical signals from the sensor and where the microprocessor-based controller is connected in controlling relation to the pulse generator. The microprocessor-based controller operates to execute a program of instructions stored therein so as to produce control signals at timed intervals to the pulse generator based, at least in part, on the electrical signals from the sensor. The microprocessor-based controller also incorporates a Watchdog timer for monitoring instruction execution time by the microprocessor-based controller with the Watchdog timer being capable of producing a flag signal when more than a predetermined period of time has been required for executing one or more instructions in the program. The Watchdog timer of the present invention is programmable, allowing its time-out period to be readily changed. This allows a first time-out period to be used during system design and a second, longer time-out period to be programmed in at the time of post-manufacture testing. If the Watchdog timer does not produce flag signals when operating with its shorter time-out period, it is highly unlikely that such flag signals would occur with the longer time-out period that is programmed in at a point in time prior to implantation of the device in the patient.